> DESCRIPTION
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.
> CWE DETAILED DESCRIPTIONS
CWE-295: Improper Certificate Validation - The product does not validate, or incorrectly validates, a certificate. | CWE-296: Improper Following of a Certificate's Chain of Trust - The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate. | CWE-494: Download of Code Without Integrity Check - The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.